2024E15 - Apple iOS Personal Device Enrollment (I.T)

Visit our websites and social media for more or to get in touch with us
Steve Hosking - Microsoft MMD Team
/ onpremcloudguy
github.com/onp...
Adam Gross - Microsoft MVP - Enterprise Mobility
/ adamgrosstx
www.asquaredoz...
github.com/Ada...
mvp.microsoft....
Ben Reader - Microsoft MVP - Enterprise Mobility
/ powers_hell
www.powers-hel...
github.com/tab...
mvp.microsoft....
Jóhannes Geir Kristjansson - Microsoft MVP - Enterprise Mobility
/ jgkps
/ j%c3%b3hannes-geir-kri...
mvp.microsoft....

[@jotajota_ok]

I love that you guys don't cut out those parts where you face issues. Showing the whole thought process and what you do to fix it. It feels natural compared to other videos that just works perfectly (which we know is not something Intune does lol) Thanks for this series. Big fan.

[@alexk7837]

Great format, guys. Keep them coming.

[@TheDnlnext]

12:09 “The administrator may collect personal data” However, that disclaimer should probably be highlight. I was going to install this on my personal device, but the disclaimer is all I need to know. I’ll como to carry two devices. 🤷‍♂️ Anyone disagree? Explain. I know both about IT (hence me searching the web on this). I’m ignorant as to how that disclaimer shouldn’t steer anyone away.

[@mankindunkind86]

Great tutorial, as ever! It would be great if you could shed some light on User enrollment and Device enrollment options available in iOS enrollment.

[@andrewwilson8717]

my understanding is that user enrolment is for BYOD and does not allow things like wiping the device which is really important. Device enrolment is for corporate devices but ABM gives you a much better experience. In my opinion they need to improve iOS enrolment - Android has a far easier to manage ecosystem for both BYOD and corp owned devices

[@randomzebra1233]

What about web-base device enrollment with JIT?

[@speakup11]

Intune will end support for user enrollment with Company Portal shortly after the release of iOS/iPadOS 18, because Apple will no longer support profile-based Apple User Enrollment. From what I understand the Account driven user enrollment: Also referred to as account-based enrollment is the new way to enroll BYOD iOS devices.

[@shoaibkhan-ll4hn]

Do you know how we can configure this type of enrolment ? Bit stuck on prerequisites I.e., to publish json file which can communicate with apple and Intune

[@VirgilKane1]

So is this video pretty much obsolete now?

[@tomekkrakowiak2398]

10:24 how is the user that never enrolled going to enter the MFA code and where; if that person is only using single device?

[@JWBCvideos]

Loving the videos guys! I'm sure you're about to do some followups on Android and maybe other mobile devices, but one topic I'd love to see covered is managing shared devices. In particular, I find intune licensing with shared devices a bit perplexing. Will every user need an Intune license? Can I assign the license to a device group? I want to manage some computers hooked up to a pay-to-print system, I want to manage devices used by multiple part-time employees, and I want to manage devices intended as loaners to guests and unfortunate staff. The questions sprouting in my mind makes me feel this has some real meat to its bones. Even as I find my own solutions, I would love to see your breakdown!

[@chrisdranschak2590]

This is a great video. I have a question I am hoping someone here can help answer. To perform user device enrollment in this same scenario, do this require you to federate ABM with Azure?

[@shashikantovhal1769]

In my org, personally owned devices are blocked for enrollment in intune, but when I try to enroll device, I can install Authenticator and complete MFA setup and when I sing into Company portal it idownloads management profile but itts instalation fails. Is it happening just because BYOds are blocked? I removed existing profile which there was only one and tried reinstallation still it failed

[@usey5557]

Gents i’m sure on personal devides a wipe shoud be remove corporate data only as its within a bubble? I.e. corporate data is store seperately and when wiped it should only wipe that data? Thanks for the video!

[@jonnyg81]

It deffo doesn't. And 1 of the big reasons no personal device should EVER be enrolled into an MDM solution.

[@RnD-ITMEM]

You guys are a Rockstars! I dream about the day I can meet youin person at my first mms. I've been studying all Intune MS documentation and watching all your videos multiple timefor more than 2 years now. Leaving all those tangent pieces is how I figured out so many things I was struggling with. I dont mind 2 hour long videos only with brainstorming an issue. I finally started full Intune project at my company. How do you go about with only MAM non enrolled iOS devices but management is stuck and won't give up Apple Mail? Does MAM APP and AConfigP only applies to Outlook as ios mail client and Apple Mail must be blocked? Can I do that for MAM and if they still want Apple Mail I mandate MDM enrollment so they can use it? That might be complicated CA policy situation?

[@MarcosCouncil-DoITContractor-]

How would approve this enrollment?

[@nickdickson2236]

Hi guys, I work for an organisation with multiple sites on a shared tenancy. Can you only have 1 instance of the Apple push certificate per tenancy or can you have multiple. Do you also know whether you can connect multiple Apple Business/School Manager setups to 1 tenancy?

[@IntuneTraining]

Last I heard you can have multiple, and you can use scope tags to target access as needed

[@nickdickson2236]

Good to know, thanks for the response

[@jonnyg81]

Should never be enrolling personal devices of any OS type. Ever. Straight block with no exceptons. With all the MAM components that are available today (and constantly being added to), I'm still to see a valid business requirement for enrolling a personal device in the 8 years I've been using Intune.

[@IntuneTraining]

Some companies don't want to go through managing Business device fully as supervised devices registered in ABM. Or aren't able to get devices registered in ABM. They can be enrolled as personal but managed as corporate. But overall, yes, adding personal devices makes management very difficult.

[@TheMowgus]

Curious, can you push or require a specific app be installed on the device if it is not enrolled?

[@papajohnscookie]

What about pushing apps to devices?

[@jonnyg81]

Why would you want to be pushing apps to a personal phone? Jesus that's horrendous architectural process

[@jonnyg81]

@@TheMowgus Nope. And neither should you ever want or have a need to. Management and administrative nightmare